By now, you’ve no doubt heard of WannaCry, the ransomware attack that impacted over 300,000 victims in more than 100 countries over the past 10 days. While we’ve all focused on effective patching strategies to prevent further infection, an important part of the discussion is how to plan for a successful incident response (IR) to ransomware and other types of attacks.

Nipping Ransomware in the Bud

When dealing with ransomware attacks, the primary goal is to avoid falling victim in the first place. The key is to consistently back up your most critical data. You should also ensure that your backup servers and systems aren’t always connected to the network. That way, a ransomware attack within your environment will have little impact, since you’ll still be able to access your critical data.

That said, an effective backup strategy is simply one part of a larger security and response plan, which should be developed proactively. To successfully combat ransomware and other types of targeted attacks, it’s critical to create an incident response plan, document it and test it regularly to identify gaps and changes within the environment.

Watch the webinar series: Orchestrate Your Security Defenses to Avoid Ransomware Attacks

Building an Effective Incident Response Plan

Organizations that have a documented incident response plan and an IR team, whether it’s internal, external or a combination of both, can respond to a breach more quickly than those who don’t. Organizations that are able to complete an investigation in 30 days or less save an average of $1,000,000 over those who don’t.

Furthermore, organizations that document their plans and test them quarterly or biannually are able to more effectively prepare for security incidents and practice their response actions in advance of a real attack. This allows these enterprises to accelerate the process of response and investigation, greatly reducing data exposure and financial losses.

An effective response plan should contain a broad scope of technical and nontechnical actions that need to be conducted by all stakeholders within the environment. This requires leaders to ask questions such as:

  • Does the information security team have the data needed to perform live responses on hosts in the environment? Is that data searchable from a central location? Are analysts able to pull data from or images of remote hosts when needed?
  • Does the organization have contracts in place with external crisis communications firms, outside legal counsel specializing in privacy and experienced incident response firms who can supplement the internal teams?
  • How do stakeholders within the organization communicate with each other when there is concern that email systems may be compromised by an unauthorized actor?
  • What information are employees authorized to communicate to third parties during a breach, if any? Are employees aware of this policy?
  • What type of communications will be shared with the news media by the organization? Are there holding statements already crafted that can be used in a crisis?

Documenting and regularly testing a variety of scenarios helps organizations determine where gaps may exist. Most importantly, this enables security teams to fix vulnerabilities in advance of a breach.

How IBM Can Help

The X-Force Incident Response and Intelligence Services (IRIS) team specializes in providing incident response planning, program development, response to critical breaches, remediation and threat intelligence to clients in over 133 countries. We have experience responding to and containing many of the largest data breaches in the world.

To learn more:

More from Incident Response

What cybersecurity pros can learn from first responders

4 min read - Though they may initially seem very different, there are some compelling similarities between cybersecurity professionals and traditional first responders like police and EMTs. After all, in a world where a cyberattack on critical infrastructure could cause untold damage and harm, cyber responders must be ready for anything. But are they actually prepared? Compared to the readiness of traditional first responders, how do cybersecurity professionals in incident response stand up? Let’s dig deeper into whether the same sense of urgency exists…

X-Force uncovers global NetScaler Gateway credential harvesting campaign

6 min read - This post was made possible through the contributions of Bastien Lardy, Sebastiano Marinaccio and Ruben Castillo. In September of 2023, X-Force uncovered a campaign where attackers were exploiting the vulnerability identified in CVE-2023-3519 to attack unpatched NetScaler Gateways to insert a malicious script into the HTML content of the authentication web page to capture user credentials. The campaign is another example of increased interest from cyber criminals in credentials. The 2023 X-Force cloud threat report found that 67% of cloud-related…

Tequila OS 2.0: The first forensic Linux distribution in Latin America

3 min read - Incident response teams are stretched thin, and the threats are only intensifying. But new tools are helping bridge the gap for cybersecurity pros in Latin America. IBM Security X-Force Threat Intelligence Index 2023 found that 12% of the security incidents X-force responded to were in Latin America. In comparison, 31% were in the Asia-Pacific, followed by Europe with 28%, North America with 25% and the Middle East with 4%. In the Latin American region, Brazil had 67% of incidents that…

Alert fatigue: A 911 cyber call center that never sleeps

4 min read - Imagine running a 911 call center where the switchboard is constantly lit up with incoming calls. The initial question, “What’s your emergency, please?” aims to funnel the event to the right responder for triage and assessment. Over the course of your shift, requests could range from soft-spoken “I’m having a heart attack” pleas to “Where’s my pizza?” freak-outs eating up important resources. Now add into the mix a volume of calls that burnout kicks in and important threats are missed.…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today